Merge branch 'main' into fix/stale-jwt-revalidation

server/src/utils/auth.js

@@ -96,6 +96,16 @@ async function isLoggedIn(req, res, next) {
   }
 }
 
+// Gate middleware factory: allow only the listed roles. Assumes isLoggedIn ran
+// first so req.user is populated. Use for admin-only endpoints (users, site
+// mode, settings) so a lower-privilege editor cannot reach them.
+function requireRole(...roles) {
+  return (req, res, next) => {
+    if (roles.includes(req.user?.role)) return next()
+    return res.status(403).json({ message: 'Forbidden' })
+  }
+}
+
 module.exports = {
   COOKIE_NAME,
   signToken,
@@ -104,4 +114,5 @@ module.exports = {
   clearAuthCookie,
   getUserFromRequest,
   isLoggedIn,
+  requireRole,
 }